Lucene search
+L

255387 matches found

CVE
CVE
added 2026/08/11 12:17 p.m.32 views

CVE-2026-72750

CVE-2026-72750 affects n8n prior to 1.123.67, 2.31.5, and 2.32.1 due to a SQL injection in the Snowflake node's Execute Query operation, where unparameterized expression values are interpolated directly into the SQL string. The underlying issue allows an attacker-controlled value to alter the que...

5.3CVSS5.6AI score0.00211EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/11 12:17 p.m.10 views

EUVD-2026-56139

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

7.1CVSS5.4AI score0.00308EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/11 12:17 p.m.6 views

CVE-2026-72749 n8n before 1.123.67 Prototype Pollution via Edit Fields

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

7.1CVSS5.4AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/11 12:17 p.m.31 views

CVE-2026-72749 n8n before 1.123.67 Prototype Pollution via Edit Fields

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

7.1CVSS0.00308EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/11 12:17 p.m.10 views

CVE-2026-72749

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

7.1CVSS5.3AI score0.00308EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/11 12:17 p.m.28 views

CVE-2026-72749

Technical details about CVE-2026-72749 are not publicly available in the provided documents. Monitor for updates.

7.1CVSS5.4AI score0.00308EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/11 9:17 a.m.5 views

CVE-2026-15555

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

8.8CVSS0.00263EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/11 8:49 a.m.8 views

CVE-2026-15555

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

8.8CVSS5.4AI score0.00263EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2026/08/11 8:49 a.m.6 views

CVE-2026-15555

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...

8.8CVSS5.4AI score0.00263EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/11 8:39 a.m.9 views

EUVD-2026-55978

openvt -u is intended to identify the owner of the current VT and then execute login as that user from a privileged context. In the documented kbrequest/init usage, the ownership test in authenticateuser relies on stat"/proc//fd/0". stat on /proc//fd/0 follows the symlink to the underlying TTY...

7.8CVSS5.5AI score0.00106EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/11 6:46 a.m.8 views

ROOT-APP-NPM-CVE-2022-23529 CVE-2022-23529 in jsonwebtoken - Patched by Root

Root has patched CVE-2022-23529 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...

6.9AI score
SaveExploits0
RedHat Linux
RedHat Linux
added 2026/08/11 6:44 a.m.5 views

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

8.7CVSS7.2AI score0.00418EPSS
SaveExploits1References7
RedHat Linux
RedHat Linux
added 2026/08/11 6:44 a.m.6 views

Important: Red Hat Security Advisory: nodejs22 security update

An update for nodejs22 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

9.2CVSS6.3AI score0.00424EPSS
SaveExploits2References4
RedHat Linux
RedHat Linux
added 2026/08/11 6:44 a.m.5 views

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

9.2CVSS7.4AI score0.00424EPSS
SaveExploits1References7
Tenable Nessus
Tenable Nessus
added 2026/08/11 12:0 a.m.12 views

RHEL 10 : nodejs22 (RHSA-2026:53298)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:53298 advisory. Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an...

9.2CVSS5.6AI score0.00424EPSS
SaveExploits2References8
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.3 views

PT-2026-70172

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at...

7.1CVSS5.4AI score0.00472EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.3 views

PT-2026-70163

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled expression data directly in a raw SQL...

5.3CVSS5.6AI score0.00211EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.3 views

PT-2026-70168

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type confusion vulnerability in the Send Email node, which does not enforce that its message fields are strings. A crafted non-string value supplied from a workflow expression into the text or HTML body field can be...

8.2CVSS5.5AI score0.00278EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.2 views

PT-2026-70165

n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow when workflow sharing is enabled who knows a...

7.2CVSS5.3AI score0.00215EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.3 views

PT-2026-70169

n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticated users with rights to create and execute workflows can stage a crafted local repository that causes git to run hooks under default git security settings,...

8.7CVSS6.3AI score0.00387EPSS
SaveExploits0References3
Rows per page
Query Builder